Splunk Search

Percentage of overall volume with timechart command

tmurray3
Path Finder

I am trying to create a report to display the top 5 clients by total volume and their percentage of total volume from a summary index.

Currently, I am reporting top 5 clients by total volume. Here is my query:

index=client_volume_hourly_summary report="keyvolumebyhour" | timechart limit=5 span=1h sum(count)  by clientkey

    _time   c1  client2     OTHER   client3 client4 client5
1   12/15/14 12:00:00.000 AM    587556  184696  989182  1204554 1616047 1100108
2   12/16/14 12:00:00.000 AM    11343   28820   366656  74062   573534  100928

Since the index summary was not created with the sitop command, is there another way to calculate the top 5 clients which displays volume by clientkey and total percentage of overall volume by clientkey?

Thanks in advance for your help!!!

Tags (2)
0 Karma
1 Solution

tmurray3
Path Finder

Here is the query I used to solve the problem:

index=client_volume_hourly_summary report="keyvolumebyhour" | timechart span=1d sum(count) by clientkey limit=5| untable _time clientkey count|eventstats sum(count) as Total by _time|eval keypercent=round(count*100/Total,2)| table _time,clientkey keypercent | xyseries _time clientkey keypercent 

View solution in original post

0 Karma

tmurray3
Path Finder

Here is the query I used to solve the problem:

index=client_volume_hourly_summary report="keyvolumebyhour" | timechart span=1d sum(count) by clientkey limit=5| untable _time clientkey count|eventstats sum(count) as Total by _time|eval keypercent=round(count*100/Total,2)| table _time,clientkey keypercent | xyseries _time clientkey keypercent 
0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...